"I'm trying not to get hacked:" How Adults with Intellectual and Developmental Disabilities Navigate Security and Privacy Notifications

2026-10-01

AI Summary

This study addresses the neglect of cognitive accessibility in existing security and privacy notices, which impedes individuals with intellectual and developmental disabilities (IDD) from navigating digital risks. Through formative user research and qualitative analysis, this work investigates how individuals with IDD perceive notices across mobile and web applications. Moving beyond the conventional approach of merely simplifying terminology, the findings reveal that context, terminology, and uncertainty constitute three critical factors shaping their decision-making. Accordingly, this work proposes a novel design paradigm emphasizing context-dependent comprehension, transparent action consequences, and support for interdependent decision-making. Ultimately, three design principles are distilled to provide both theoretical grounding and practical guidance for developing accessible notice systems that empower individuals with IDD to engage securely in digital environments.

Abstract

Security and privacy notifications, such as login alerts, spam email warnings, and cookie consent requests, play a critical role in shaping users' responses to digital risks. Yet most notifications overlook cognitive accessibility, limiting their effectiveness for people with intellectual and developmental disabilities (IDD). We investigate how adults with IDD perceive and respond to common security and privacy notifications across mobile and web applications. Through a formative user study with seven adults with IDD, we identify three factors shaping understanding and decision-making: (1) interpretation is influenced by task and interface context; (2) unfamiliar terms, both technical and non-technical, are grounded in everyday concepts; and (3) uncertainty about outcomes leads to hesitation, avoidance, diagnostic exploration, or support-seeking. These findings lead to three design implications: (1) address context-dependent language misunderstandings beyond jargon simplification; (2) make action-outcome connections transparent; and (3) enable interdependent decision-making. Together, these insights aim to inform the design of more cognitively accessible security and privacy notifications that better support safe and supported user action.

Problem

• Intellectual and Developmental Disabilities
• Security Notifications
• Privacy Notifications
• Cognitive Accessibility

Innovation

• Cognitive Accessibility
• Security and Privacy Notifications
• Intellectual and Developmental Disabilities
• Human-Computer Interaction
• Inclusive Design